Skip to content

v0.2.0

Choose a tag to compare

View all tags
@pablospaniard pablospaniard released this 26 Aug 14:17
v0.2.0
78295d3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Adds the first standards-pinned A2UI v1 Candidate path while retaining the custom 0.1 surface model for compatibility. The v1 adapter remains intentionally partial and fail-closed for renderer behavior that is not yet implemented.

Added

  • MCP extension capability negotiation and the project-owned A2UI-over-MCP transport binding.
  • Checksum-verified A2UI v1 Candidate schemas pinned to an exact upstream revision.
  • Ordered v1 lifecycle parsing and bounded surface state for create, component update, data-model update, and delete messages.
  • Pre-render catalog, graph, binding, placement, event, function, and nested formatString validation with explicit host allowlists.
  • A React Native adapter for the supported static A2UI v1 component subset.

Security

  • Reject runtime-provided formatString sources and validate literal-source interpolations against the pinned catalog before rendering.
  • Bound interpolation depth, expression count, and cumulative source length.
  • Make npm trusted-publishing recovery retry-safe while retaining immutable release-commit verification and package provenance.
Assets 2
Loading